Analysis
-
max time kernel
141s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
13-09-2024 12:40
General
-
Target
2024-09-13_1d3dedb8b528883e64177d5e9ef0bc60_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
1d3dedb8b528883e64177d5e9ef0bc60
-
SHA1
9745c572859a598535e26e26e10c0596580d19f7
-
SHA256
24f418bf69d16e85e94110b086abbbac86fcddf0659c89b6cc640f9fa655778e
-
SHA512
3ed7b78d81b6d6c310b7c9be365b92105b29e560c82d820dc53bb73b3f4dd924a78aa64de612a1e9ae10159f9e3576f58022e7aface95f9f5bd469f5f3c76fb6
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lN:RWWBibd56utgpPFotBER/mQ32lUh
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_1d3dedb8b528883e64177d5e9ef0bc60_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-13_1d3dedb8b528883e64177d5e9ef0bc60_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\joRvhJV.exeC:\Windows\System\joRvhJV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UeNxRhq.exeC:\Windows\System\UeNxRhq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SNlfEGR.exeC:\Windows\System\SNlfEGR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sjIgAyG.exeC:\Windows\System\sjIgAyG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\moUvThO.exeC:\Windows\System\moUvThO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uWOVjQi.exeC:\Windows\System\uWOVjQi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vFaBcuC.exeC:\Windows\System\vFaBcuC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RjnbSeK.exeC:\Windows\System\RjnbSeK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Kpwlsgs.exeC:\Windows\System\Kpwlsgs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TRZmZHx.exeC:\Windows\System\TRZmZHx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DikWZTX.exeC:\Windows\System\DikWZTX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dyAfpNe.exeC:\Windows\System\dyAfpNe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HNkDXbe.exeC:\Windows\System\HNkDXbe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\omkumlQ.exeC:\Windows\System\omkumlQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\boXpjRN.exeC:\Windows\System\boXpjRN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qDTNTLL.exeC:\Windows\System\qDTNTLL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RsgpZfo.exeC:\Windows\System\RsgpZfo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UEypJbN.exeC:\Windows\System\UEypJbN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pwzqfDe.exeC:\Windows\System\pwzqfDe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ACVBbxp.exeC:\Windows\System\ACVBbxp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xwNEqOv.exeC:\Windows\System\xwNEqOv.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5e14a47d31912c9d331bb5f94544ea88e
SHA1943410abcdd1f81f5b61675a13a37e8889821918
SHA2568c0fe15e7686f6c06852a157afa3e449f0f59f43dd5535ffbbeefe38575ff1ad
SHA512b756ae49d5198376d7465af2f13a70c0a60ca3476cad0f33f31e21fd5398d9e49bbb9014ad2ea4cea5a889b001d41a7e95258925772ec2b9ab04ea459201f740
-
Filesize
5.2MB
MD55da75cfe415c65c2b10212c9178639ee
SHA1e4a547d842dea1b8c932b9ad27d0fe7576eafbfc
SHA2567c04d9e186de25b9a214a02e031d788f0448aa9e0b1bfa9ac597f0ca36b202d5
SHA512771a0f118fe2ade5ebf7d1a2356dc4e9e67effa71ce6b4b87fea0038bd48be58afc52f6be2dac8f9f8718cf3369ab26a7048ea6a711c3e2b4750caf9691e18c4
-
Filesize
5.2MB
MD583f044b1532d864331447f4c5c940129
SHA1e843d04bccbdb41eb017131b7ddcdbd3deb079ec
SHA256196319fcc28fdcd24cafa64560649d60be2f66dad9ffd8e790a6945fcdba80c8
SHA5120acffb765479ee12207ba84bc7cfa8722fe1de298987483cd6d29556225cb372047395204a8a0b3e8b4a61df1a1b6daa142cbd1b6fd7fc2eb160836acdca9222
-
Filesize
5.2MB
MD5fb078425fe27f941e6c13df7922e7103
SHA1df5cfeb9f22026ce49a81492cb1a6d16ba4d11f5
SHA25633496f6fd0caa1d909a01d38cb2c1493dbfbe3a0778595b915987f3a3b1f5574
SHA512293320c9b02b6b5075f3cbc6a04e8727ec00007ab03ae4e0cd79e64afe35d90893f95cf55c9a02e923c2a130f42d8906285a39fd0406b3a7795e7bc33673e317
-
Filesize
5.2MB
MD5b7f158f53eec4d4613c29325ce68857b
SHA1ed13de28d8b1a650736c77e1c179a66754a50a29
SHA256c6a43f45f151bdddc278a4409aeed0091c96417030960cdfa8a4ee9cceb4fc8e
SHA512047f3051970b97e54875a50fa838491a803e413a291eeb1c51783c5ba5dafe3ab04a50347e4db73acab748d8e0597c94309ccaecbfbf23ad103abc27edae1219
-
Filesize
5.2MB
MD5c1a085536fb8e6576c8720ba72269a0c
SHA187dc28fce4bfd60f4fe7de6f25d8a2fc891788c3
SHA256596346db6d5d4538d369c36292f17a1879d94b9b7b1bf15706d8ad3dc252253b
SHA512c506cf3bb1b17a993434ab83ce8efe909903bfa2e15583526c8c193cfc752e54f0cde136abb11ccd8dd4f407ac947c26989bef0f2ae595cb84701cbaa078da23
-
Filesize
5.2MB
MD5539e3813ee89acd7cc547a31073160c8
SHA1ce12f2fb848776121faac6eba14d2829bd6f99c5
SHA256651b314dfd6deae10c63adf31c93a0fe95e502e2616cfc8faa39bf07b8318cd6
SHA5124f25058be6f90ffe09a491e8a031c36f7998ee90f30be846d579dfb8a46ae8c2a354cefa58577dccda57422ff1f2cde33e858a591d74fba0067758e0fd86042a
-
Filesize
5.2MB
MD533210b8394921508189e1f4e57b0a8e3
SHA1ea5c78605299a103ea946d47ab3df80383801fb1
SHA2563e9e74b88c49ee6733692658224460e8cf636b86c5a354695aa84c364f030bcf
SHA512a1a0d370d3691a3e3ff0f853df9e418a80519d606fee8a50f543b727564b7e799ab674009c38321475463615aa9cd11c5751cd4866dd281d1b95f43427fced14
-
Filesize
5.2MB
MD501f667c2480f380216e1a26afdee5366
SHA1348ee42ae0af6995db1f269f3d9f86b1047a208f
SHA2561af1f771f589c7f46070b61dd3e4ffb437ec2855d49ad5f8ba5fb3abd7d8618b
SHA512ea0b73a8316416e3d7ec4b241dd5314b39b72aa77d05c0d7d4c48031fac69f825964b549db8c5530dbf943de46a247881c3044f8473e1706726cce68f99c2a68
-
Filesize
5.2MB
MD5bc08e2def3a2e77bfe98b3b9a00c8431
SHA1301b0f7463a8a33da3a6620cf90580d865c293a7
SHA2560b2be1a1f98932f89937dcda7c112e00b61871b34eea9e1776f0f05cda953d24
SHA512f2ae8b1e81088a34586565cf7ec2b8f33ab3d143faf12c6f238a225471acc01b66000a14b2a98a1f9721912cb21f48253f69bf3c532bda1137975c0d096b4aca
-
Filesize
5.2MB
MD55b3d3f4021e63cdeeec93936de4bfb0a
SHA1eaa0c0936066f2d2fb8a83d2e644ace74621f8ad
SHA256bb8a0e99cddf7618e6ab98fad30a4c24c421b8fd46cf75508a8bc4b307493957
SHA5126127033ca1e731ee36b928042ec89027115412a108a9a0b1a7631c7bf6d15e625df5291973c8379fbb54f807b7409807655c05d57f152c359390082488b2b563
-
Filesize
5.2MB
MD53a4f06ca9c81b4f2bfd3a37e4ed15b0b
SHA11ead45242f88608752acc67e8e38b9d0fc30c105
SHA25609efb0f02afba5d2378e2a6e93eda305821e172220568a859c7a101754860662
SHA512c6253ee795f1ef77057415d3b1f1f1917705fbaedf759499deb5c74291cc7a7875b2935741b620c92a81c844655ad1925bc8cf9dca452eafba5af575d3faf1a1
-
Filesize
5.2MB
MD59b655493f01b878c4e4d751d3198a63c
SHA13f370562fa9268f3649bb8bcaf705a9050cdbcbc
SHA256d705ae68b9f7f95d8c3e61eac17347ae728156844396eefa2b03051da7383af8
SHA512968ccc991e48a723c82fe71eafd8164347aa04aaf6c62543176a38f33cee28e2caaf0b6a7fa77f42f23078d47928f920f64f3c945bf25ab01f83f52e74ce2253
-
Filesize
5.2MB
MD5d4ce3ddb300714fe71ab5ee1f7f7531c
SHA190128e7a4fdcfabc9c557e19abeed8c8cde5d78d
SHA25652ee1ce5da4626bf024fa85a64b4373838c8446ab41e7130b0670dea5af680ed
SHA5127768e64547d35a9820caea2e8fa3c4eab6cf3753729a1e8dd83a51778add5fc8285552b26e0ecab573f3b334c783e0ef320ab47172c85aecb12c4c587e986e0c
-
Filesize
5.2MB
MD5049ccbd9b19ba10ee6f1d888493c761c
SHA16365a84929ff5b06074e850e61904eb319eef9bb
SHA256a9b2dc857ecb47a6ea2eb0924e6d0a2fddb61b724796b86cdf91bb1766f05123
SHA512b1b94456db105de63592ba56b2564010a0acd7287b197be6e1105129c072a85b4588f88d0f44b0e8367011b418c2ed8c0da22b1ace0e21b513936155ae1c7880
-
Filesize
5.2MB
MD563712832f2e6bfe2a7a64bf05c2d94b1
SHA1df3ddbd3e7f29fedb5a4921008e21075e90daa25
SHA256d2fe8a5c09c85269598c646f2cfd0020e1b45be1fe001d478453d0b56c73d3e1
SHA5123b3f4e687f6c070f10cf408ce06b1cd8a487bcdba0cb87dda672ac14e12188ea8ec83fba219a876e6c138863705eb8cdcb26a149ca1dcc53d9d9a1e6018677ae
-
Filesize
5.2MB
MD567df955e4d6e1246cb86caf32d5053eb
SHA18dfef5db316e786114a1c11885a4f22b81b5512d
SHA256c5187af16a54f9e192fe6deb390ff02a9ffec17437dcd77ecef95aac250e9e38
SHA512f4cdd4c05bec13db7382fa986272e01e644478fc1e28b2727e26f5c3a9a8ff34f77fec12bb1dbae7c0fc73fabe9f3b90724941887c23016c3ef500ad01ab741e
-
Filesize
5.2MB
MD541a1fe58262908c5c011b485cfe5ebd5
SHA1c82e71c5581ff410f2e42b6f1a2f378e004be62a
SHA256f2121c8970cedca6da3846ba80287b8e8026d0727125eac53e017e19916715aa
SHA512543abbad47f65b1d1404b3ac292daa08182d33e77e4ae1fba142416d4f0bdb946eb93c31ab15643d4408f7fd64bfcc1e6c8528e3106c11f9014e74fd65ac9e00
-
Filesize
5.2MB
MD5aafae9178dcc1d5b560b3c9400bb76d1
SHA129637141bc8db5e9b89edb6a78c44437bb5a8443
SHA256c352cb84981a433f2b24b1307dbda52597082b1d94ed2c8d953a1a4a3d9633ea
SHA51296657231e03dc67d77dda3f2e9eaf6180b62c17b909b9dd2e314b367e98795420367910c20aa04b1e301d8f741998bc7b43ca518ba05021772fd04be0ff77cac
-
Filesize
5.2MB
MD5c2cb4baee12210d97d4eb0d4d75a2328
SHA15c6f136cacba8748ecc9f63db1224deaec438c8a
SHA2565b81a918d7e64e29333733fdd6a4a058ae0b379aef1eaab830f14ecb5d1e338a
SHA5123ac0ca0b8e729fd99aeb975f8f0afae10fb405903ad6f558de475ff9aaf47e4316282ba74ab6a00b037e1bd0bad62c2af95a08b05b11ddd7a66a4c1a5d6dbf40
-
Filesize
5.2MB
MD515f486a0b521a606a815cf42ab80c987
SHA1eb5519bacc40455b49ec2e5b338cf093319dd07b
SHA2563ab6d86b451a71a6e361df89463b054104f66402b0576a8e185425ed0b1105ba
SHA5121d20479c903cc044e6b96c9611f537b149ba66de98e7aa37fbd1708c36bb2c051f52cd6a90b0242e47f82c8b2bcc681e7758ea49ab4be5ffef24f025fbe2c2d1
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB